creekex[.]com

Analysis of creekex.com indicates a high-risk phishing infrastructure that remains operational as of July 12, 2026. The domain was registered on March 13, 2026, through a widely used registrar, and currently resolves to the IP address 184.94.213.112. Infrastructure analysis reveals the use of LiteSpeed web server technology, a configuration often observed in both legitimate and malicious deployments. The server presents an 'Index of /' directory listing, which may expose sensitive files or serve as a staging point for phishing content, though the exact nature of the hosted material has not yet been confirmed through direct inspection. Security vendors have flagged this domain with varying levels of confidence. Five out of ninety-five engines on a widely referenced malware detection platform have identified the domain as malicious, while two security blocklists have included it in their denylists. Additionally, the domain appears in twenty-four threat intelligence pulses, suggesting recurring associations with known malicious activity. The SSL certificate, issued by a major certificate authority, does not provide meaningful assurance of legitimacy, as certificates are routinely obtained for both benign and malicious domains. The domain's trust score of 15 out of 100 further supports the assessment of elevated risk. While the specific target or phishing campaign remains unclear, the combination of directory listing exposure, recent registration, and multiple security flags indicates a likely intent to deceive users. Defenders should treat this domain as hostile and consider implementing network-level blocking for the IP address 184.94.213.112, as well as monitoring for any connections originating from internal systems. Given the domain's continued activity, organizations are advised to review logs for prior interactions and assess whether any credentials or sensitive data may have been exposed.